Commands

The default command is ssh.

ACS

Plugin to interact with Cisco ACS. Allows for ACS device creation, ACS device info gathering, and ACS device IP address changes directly through NSCLI.

Command

nscli acs add $coreid

Command

nscli acs info $coreid

Options

-c, --config

produce configuration for target device

Command

nscli acs changeip $coreid $newip

Command

nscli acs migrate $coreid $newcoreid

ADX

Plugin to interact upload and download ADX certificates and scripts from a Brocade.

Command

nscli adx $device

Options

--uploadssl

upload ssl cert and keypair

--uploadscript

upload OpenScript to the ADX

--listssl

list all SSL certificates and keys on the ADX

Command

nscli adx sanitize pull $device

Pulls a config from a device and returns the sanitized version of it

Options

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli adx sanitize input

Allows a raw config to be pasted into the terminal and returns the sanitized version of it

Options

-i INPUT_FILE, --input-file INPUT_FILE

Input a file instead of pasting to the terminal

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

ASA

ASA module is a parent module for ASA related sub-commands. All tools that relate to the Cisco ASA will fall here.

Command

nscli asa convert $device Convert ASA config from pre-to-post 8.3

Options

-s, --source SOURCE

Source of config <torq|device>. Default is TORQ

-v, --version VERSION

Specify the to version to put into the config and boot

--force

Force the process of an unsupported config ASA config. USE WITH CAUTION!

--noconvert

Passthough ASA config without attempting to convert it.

--nobackup

Do not make a local backup of the config. (default is true)

Command

nscli asa vpnusers $account Get all ASA local users on an account

Command

nscli asa vpnpeers $account Get all ASA VPN peers on an account

Command

nscli asa natfix $device Applies no-proxy-arp and route-lookup to ASA NAT entries

Command

nscli asa fogen $device ASA failover config generator

Command

nscli asa clientvpn $device ASA Client VPN Generator

Command

nscli asa codeupload $device Upload current code standard to ASA.

Command

nscli asa findnetworks $device Find remote encrypt domains, print VPN config for peer.

Command

nscli asa qc-static $dc $device qc IPS pulled from NAT statics

Command

nscli asa build $device $ha_device Build config/image on an ASA.

Options

-f [FILENAME], –filename [FILENAME]

Name of .bin file to use in device build

-m [MD5], –md5 [MD5]

Md5 checksum of the associated .bin file

Command

nscli asa shun $device $ip_address Manage ASA Shuns via NSCLI

Options

--user USERNAME

ASA username, if different from ACS.

--password PASSWORD

Login password, if different from ACS. Enter ‘?’ to be prompted.

--enable ENABLE

Enable secret, if different from ACS. Enter ‘?’ to be prompted

--searchonly

Search the firewall for the address(es), but do not shun

--delete

delete IP from the ASA’s shun table, i.e. “no shun <ip>”

--ignore_mask NETMASK

Ignore matches with masks of this length or shorter. For example, a value of “255.0.0.0” will cause the config search to ignore all /0 through /8 networks that would otherwise match. By default, only /0 network are ignored.

Command

nscli asa recovery $device Convert an ASA’s config to easily paste it into a console connection

Options

-manual

Manual (offline) mode

Command nscli asa vpnprep $device An interactive script to prepare VPN configuration for target device.

Command

nscli asa version_check

Audit OS Code and/or AnyConnect version(s) on given ASA(s) (live or consoled) against FACTS API. | Results are based on what is RUNNING/STORED on device

Options

-c Device:Console:Port [Device:Console:Port ...], --console Device:Console:Port [Device:Console:Port ...]

For cycladed ASAs : Device + Console information : Device:Console:Port, Once for each device, for example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016

-d dev [111112 …], --device 111112 [111112 …]

Core device number(s)

-w, --webvpn_only

Check only for AnyConnect versions, not for code version.

-o, --code_only

Check only for OS code version, not for AnyConnect versions.

-v, --verbose

Provide step by step details of the tasks being done.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Command

nscli asa vpnprep $device Prepare required commands to built a new IKEv1 L2L vpn on an ASA.

Command

nscli asa md5 $device Verify MD5 Checksum without unlocking ZSP

Options

-file FILE

Filename to check

-checksum CHECKSUM

Checksum to verify against

Command

nscli asa static_nats <network device> <List of individual IPs, pairs of IPs, or device numbers>

Preps or configures static address translations

Options:

-m, --manual

Makes the displayed commands usable in a copy/paste format for manual configuration

-p, --perform_changes

Performs the translation configurations on the network device.

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username, --username username

Specify a different username to log in with. Will prompt for passwords.

--no_dns, --no_dns_doctoring

Prep or configure translations without dns doctoring (only works with ASAs)

--no_qc

Prep or configure translations, even if they do not pass QC

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli asa qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username

Specify a different username to log in with. Will prompt for password.

-v

Connects to Environment Manager and Core to return more detailed information about results

-vv

Connects to Environment Manager and Core to return more detailed information about results in CSV format

-t, --timeout

Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli asa ol <account> <IP>

Options:

-p, --prefix

Checks if the IP belongs to an object-group network prefix

-r, --report

Shows all configured objects and Object-groups for the specified account

Command

nscli asa portalcomments -c <current> -n <new>

Copies customer portal comments from current asa to new asa

Options:

-c,

Current ASA Firewall

-n,

New ASA Firewall

Command

nscli asa pt $device $source_ip $destination_ip $destination_port

Options

--sport SPORT

source port (default is 1024)

-u, --udp

match UDP (default TCP)

-D, --detailed

detailed output

Command

nscli asa sanitize pull $device

Pulls a config from a device and returns the sanitized version of it

Options

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli asa sanitize input

Allows a raw config to be pasted into the terminal and returns the sanitized version of it

Options

-i INPUT_FILE, --input-file INPUT_FILE

Input a file instead of pasting to the terminal

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

AWS

Generates updated ASA and Juniper objects

Command

nscli aws aws2obj $object_name

Options

-a, --asa

Generate Cisco ASA Object-Group.

-j, --juno

Generate Juniper SRX Address-Book.

-r REGION, --region REGION

Filter by region. Ex. us-east-1.

-s SERVICE, --service SERVICE

Filter by the service. Ex S3.

-6, --ipv6

Include IPv6 entries.

Bandwidth

Provides customer billable bandwidth for range provided

Command

nscli bandwidth $account_number $start_date $end_date

Options

-b, --bytes

Display all numbers in Bytes

-kb, --kilobytes

Display all numbers in Kilobytes

-mb, --megabytes

Display all numbers in Megabytes

-gb, --gigabytes

Display all numbers in Gigabytes

-tb, --terabytes

Display all numbers in Terabytes

--month

Summarize down to months instead of days

Cbast

The cbast command will log you into the customer bastion in that DC using the VIP, if your key is not present it will exit with a warning.

Command

nscli cbast $DC

Options

-1

Connect to cbast 1 instead of the VIP

-2

Connect to cbast 2 instead of the VIP

Certificates

The ‘certificates’ option will have TLS certificate related sub-commands

Command

nscli certificates prep

Parse one or more cert/keys from tickets/attachments or local directory and prepare files to upload to net devices

Options

-i INPUT_DIR, --input_dir INPUT_DIR

Local directory where input (cert/key/CA) files are. E.g: ~/Downloads

-t TICKET [TICKET2 ..], –ticket TICKET [TICKET2 …]

One or more ticket numbers (for the account) containing certificate / keys to process. PEM formatted data in given ticket comments will be looked at.

-m, --manual_input

Cert/Key/CAs to be parsed are provided manually over CLI

-a, --attachments

When specified, attachments from given ticket number are processed for certificate / keys. Flag will be ignored, if ticket number is not specified.

-c, --ssltool_chain_fix

When specified, CA chains for all certs are populated using SSL TOOL API. Pre-existing chains from source data will ONLY be looked at of SSL Tool cannot find a matching CA chain.

-o [pfx], –output_format [pfx]

By default output file(s) are in PEM format. Alternatively, PFX (with RAX default password) output is supported. Other formats may be added in future releases

-p PASSWORDS, --passwords PASSWORDS

Local file where passwords for PFX/encrypted files are stored. Put one password per line.

-s, --ssltool_check_certkey

When specified, results are re-validated via SSL Tool API.

-v, --verbose

Used for collecting debugging information (stroed on NSCLI cache folder)

Cfgstation

The cfgstation option will log you into the config station in that DC.

Command:

nscli cfgstation $DC

Options:

-p, --public

Attempt to connect directly using the public IP instead of the private IP.

Cloudflare

Cloudflare module is a parent module for Cloudflare related sub-commands. All tools that relate to the Rackspace Managed Cloudflare service will fall here.

Command

nscli cloudflare add_members

Add members to customer’s existing Cloudflare account

Options

-d 111111 [111111 …], –device 111111 [111111 …]

Cloudflare device ID(s) from accounts for which the users are to be added

-a ACCOUNT_ID [ACCOUNT_ID …], –account_id ACCOUNT_ID [ACCOUNT_ID …]

Cloudflare account ID(s) under which the users are to be added

-m, --my_accounts

Users are to be added to ALL accounts, which you have access to

--ignore_subscription_id

DO NOT USE. FOR TESTING ONLY. Ignore ‘Default Provider Subscription ID’ associated with CF device in CORE. CF account ID must be provided in that case

-r, --rax_all

Add All users from RAX demo CF account added to new account

-s, --rax_some

Specific list of RACKER email-IDs, to be provided when prompted for

-c, --customer_ids

Specific list of CUSTOMER email-IDs, to be provided when prompted for

Command

nscli cloudflare list_accounts

List Cloudflare accounts you have access to

Options

-n, --nsadmin

List Cloudflare accounts visible to “nsadmin” service account

Command

nscli cloudflare list_members

List Cloudflare account members

Options

-d 111111, –device 111111

Cloudflare device ID. DO NOT use for multi-account operations.

-a ACCOUNT_ID, --account_id ACCOUNT_ID

Cloudflare account ID under which the zone needs to be provisioned

--ignore_subscription_id

USE WITH CAUTION. Ignore ‘Default Provider Subscription ID’ associated with CF device in CORE. CF account ID must be provided in that case

-l, --all_ids

List ALL users which are members of CF account

-r, --rax_ids

List of RACKER email-IDs which are members of CF account

-c, --customer_ids

List of NON-RACKER email-IDs which are members of CF account

Command

nscli cloudflare logs

Check (default) or enable HTTP logging for Cloudflare account. Logs stored @ Cloudflare.

Options

-d 111111, –device 111111

Cloudflare device ID(s) for relevant accounts for logs operation

-a ACCOUNT_ID, --account_id ACCOUNT_ID

Cloudflare account ID(s) (NOT CORE act) for logs operation

-s, --status

Check the status of HTTP logging for the zones under account/device

-e, --enable

Enable HTTP logging for the account/device. Applies to ALL zones under account.

Command

nscli cloudflare new_account

Create new customer Cloudflare account

Options

-d 111111, –device 111111

Cloudflare device ID

-s SUFFIX, --suffix SUFFIX

DO NOT USE. This is for testing only. Suffix to append to new CF account name.

Command

nscli cloudflare new_zone

Add new zone under customer’s Cloudflare account

Options

-a ACCOUNT_ID, --account_id ACCOUNT_ID

Cloudflare account ID under which the zone needs to be provisioned

-z customer-site.com [customer-site.com …], –zones customer-site.com [customer-site.com …]

Zones to be provisioned

-d 111111, –device 111111

Cloudflare device ID

--ignore_subscription_id

USE WITH CAUTION. Ignore ‘Default Provider Subscription ID’ associated with CF device in CORE. CF account ID must be provided in that case

Command

nscli cloudflare read_access

Command to get read-access to Managed Cloudflare accounts

Options

-d 111111, –device 111111

Cloudflare device ID(s) associated with account(s) for which access is needed

-a ACCOUNT_ID, --account_id ACCOUNT_ID

Cloudflare account IDs (NOT CORE act) for which access is needed

Command

nscli cloudflare usage_report

Get report on parameters that affect Cloudflare billing for given period

Options

-d 111111 [111111 …], –devices 111111 [111111 …]

Cloudflare device ID(s) to get the data for

-a a0c58bfb17fb35eb4f964152f532b747 [a0c58bfb17fb35eb4f964152f532b747 …], –cf_account_ids a0c58bfb17fb35eb4f964152f532b747 [a0c58bfb17fb35eb4f964152f532b747 …]

Cloudflare account ID(s) (NOT CORE act) to get data for

-c 123456 [123456 …], –core_account_ids 123456 [123456 …]

CORE account ID(s) (NOT CORE act) to get data for

-m MONTH, --month MONTH

Month number (1 to 12) for billing data (current year ONLY)

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

-1, --single_thread

DO NOT USE. For troubleshooting ONLY. Some API calls are made serially instead of in parallel.

Command

nscli cloudflare zsp <ticket>

Ticket number with CF devices to unlock. Devices will automatically re-lock if ticket status changes to awaiting feedback or any form of solved, or after 8 hours.

Conkill

Console Killer

Command

nscli conkill

Options:

-c, --console

Console to kill connection too

-p, --port

Port on the console to kill

Credentials

NSCLI caches some of your credentials. These commands let you interact with that cache. A return code of 0 means the credential was successfully gotten, set, or deleted. A return code of 1 means the credential was not gotten, set, or deleted. This could be because the credential did not exist in the cache, or because the user does not have permission to access the cache.

Command

nscli credentials get <service> <username>

nscli credentials set <service> <username>

nscli credentials del <service> <username>

Options:

service

The name of the service that the credential applies to, like sso, acs, or core

username

Your username for the service, like your sso username or acs username

DCX

The DCX nscli option provides command-line interaction to the DCX API service at api.dcx.rackspace.com.

Commands:

nscli dcx api $sub_commands Direct API calls to the DCX API nscli dcx batch $sub_commands Environment Manager batch changes helper

dedos

Dedos releated sub-commands

Command

nscli dedos [-f] $file [-d] $device

Options

-d, --device

Use live data from the ASA device

-f, --file

Parse the data from a local file (show conn output)

DCX Bridge Services

The DCX Bridge Services will allow the user to List/Create/Delete Bridge Containers and configured vlans

Command

nscli dcx_bridge add_endpoints $container_id $vlan_id Removes an endpoint/vlan_id from a given container

Options

-y

Automatically confirm vlan/endpoint to be add from container

Command

nscli dcx_bridge create_container $name $id_num Creates a container given configured vlan ids.

Options

-t, --type

Specify 1 or 2. Type 1 - used by RackConnect, Type 2 - RPIB - used for AggExnet zone bridging

Command

nscli dcx_bridge create_vlans Creates a configured vlan given vlan number and either aggr name or zone name

Options

-z

zone_name,vlan_num

-a

aggr_name,vlan_num

Command

nscli dcx_bridge delete_container $id_num Delete container for given container id

Opitons

-y

Automatically confirm container to be deleted

Command

nscli dcx_bridge delete_vlans Delete a configured vlan given configured vlan id, vlan number and aggr name pair, or vlan number and zone name pair

Options

-i, --id

Delete a configured vlan given configured vlan id

-z, --zone

Delete a configured vlan given zone and vlan number pair

-a, --aggr

Delete a configured vlan given aggr and vlan number pair

-y

Automatically confirm configured vlan to be deleted

Command

nscli dcx_bridge list_container Show container information for given container id or name

Options

-i, --id

Show container information for given container id/s

-n, --name

Show container information for given container name

-vid, --vlan_id

Show container information for given vlan id

-e, --expand

Show vlan information as part of the container

Command

nscli dcx_bridge list_rpib_aggr List all aggrs associated with the RPIB (Rapid Provisioning Internal Build) L2Service

Command

nscli dcx_bridge list_vlans

Options

-i, --id

Show vlan information for given configured vlan id/s

-z, --zone

Show vlan information for given zone and vlan number pair

-a, --aggr

Show vlan information for given aggr and vlan number pair

Command

nscli dcx_bridge new_bridge $zone_a_side $vlan_a_side $zone_b_side $vlan_b_side $type Step through process of creating new bridge

Options

-n, --name

Name for the bridge/container that will be created

-y

Automatically confirm new bridge creation

Command

nscli dcx_bridge remove_endpoints $container_id $vlan_id Removes an endpoint/vlan_id from a given container

Options

-y

Automatically confirm vlan/endpoint to be removed from container

F5

F5 module is a parent module for F5 related sub-commands. All tools that relate to the F5 product line will fall here.

Command

nscli afmrulegen Create AFM rules using NSCLI

Options

-src, --source

source ip address(es) for the rule (required for single rule)

-dst, --destination

destination ip address(es) for the rule (required for single rule)

-port, --port

destination port(s) for the rule (required for single rule)

-proto, --protocol

protocol for the rule (tcp, udp, ip, icmp | required for single rule)

-desc, --description

description for rule (default decription will contain ACS user/ticket number)

-rname, --rname

name of the new rule (default is to do ALLOW-<ticket>-<r_cnt>

-bi, --bidirectional

bool arg used to indicate if the rule should be allowed in both directions (single rules only)

-csv, --csv

name of the csv file for batch rule creation (required for batch rule)

-delim, --delim

delimiter for the csv file, default is tab to allow for copy paste from excel

-f, --fields

fields for the csv, default are “Source IP”,”Destination IP”,”Port #”,”Business Justification”, “Bi-directional”,”Protocol”

-r, --refresh

bool arg, do not use local cache for rule, pull latest config from target device

-sonly, --sonly

print only the show security firewall matching rule commands

-conly, --conly

print only the create/modify security firewall rule commands

-t, --ticket

ticket for rule name/description (required for any rule type)

-d, --device

device the rule should be created on (required for any rule type)

-unittest, --unittest

used for to test unittest logic

Command

nscli f5 rcvlan $device Generate RC VLAN commands (beta)

Command

nscli f5 certloader $device Upload cert/key/CABundle to f5 with automated assistance

Options

-c, --create

Create new SSL Profile with new cert/key pair

-u, --update

Update existing SSL Profile with new cert/key pair

-p, --prep_only

Only prep the changes and rollback for user review

Command

nscli f5 scripts $device Uploads custom scripts to F5

Command

nscli f5 haconfig $device F5 HA Config Generator

Command

nscli f5 rebuildha $device Rebuild HA Config on F5s

Command

nscli f5 md5 $device Verify MD5 Checksum without unlocking ZSP

Options

-file FILE

Filename to check

-checksum CHECKSUM

Checksum to verify against

Command

nscli f5 sip $account $ip Search IP In Pools a given account

Command

nscli f5 static_nats <network device> <List of individual IPs, pairs of IPs, or device numbers>

Preps or configures static address translations

Options:

-m, --manual

Makes the displayed commands usable in a copy/paste format for manual configuration

-p, --perform_changes

Performs the translation configurations on the network device.

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username, --username username

Specify a different username to log in with. Will prompt for passwords.

--no_dns, --no_dns_doctoring

Prep or configure translations without dns doctoring (only works with ASAs)

--no_qc

Prep or configure translations, even if they do not pass QC

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli f5 qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username

Specify a different username to log in with. Will prompt for password.

-v

Connects to Environment Manager and Core to return more detailed information about results

-vv

Connects to Environment Manager and Core to return more detailed information about results in CSV format

-t, --timeout

Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli f5_ssl_audit [-h] [-v] [-e] [-u] [-j | -c] [-a | -d ]

Options:

-v, --virtualservers

Display VS per profile

-e, --expired

Display expired only

-u, --unused

Display profiles not applied to VS’s only

-j, --json

Output as JSON formatted

-c, --csv

Output as CSV

-a, --account

CORE Account Number

-d, --device

CORE Device NUmber

Command

nscli f5 sanitize pull $device

Pulls a config from a device and returns the sanitized version of it

Options

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli f5 sanitize input

Allows a raw config to be pasted into the terminal and returns the sanitized version of it

Options

-i INPUT_FILE, --input-file INPUT_FILE

Input a file instead of pasting to the terminal

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli f5 pt $device $source_ip $destination_ip $destination_port

Options

--sport SPORT

source port (default is 1024)

-u, --udp

match UDP (default TCP)

-D, --detailed

detailed output

Facts

NSCLI interface for pulling information from the NetSec Facts API

Command:

nscli facts version $platform

Prints the NetSec standard version for the given platform (asa/ftd/f5/adx/srx/netscaler)

Options:

-m, --model

Filters the platform standards to only a specific model

Command

nscli facts version $device

Prints the NetSec standard for the specific platform model of the device provided

Finder

NSCLI implementation of Hozers Finder tool

Command:

nscli finder $search_string

Options:

-s, --seniority

View the finder seniority report

-l, --locations

Employee count by location

Fleet Tools

NSCLI tools for acting/reporting on large chunks of the fleet.

Command:

nscli fleet_tools naas

Execute arbitrary commands against an arbitrary list of Netsec devices.

Options:

-t, --threads

Number of threads to use for this task.

--device_type

choices: “cisco_asa”, “f5_tmsh” Device type, ASA by default.

-s, --send_config

Use the NAAS /send_config method to deliver configuration changes to a device

--save_changes

If applying config (via –send_config) also save these changes

-c, --commands

Command(s) you wish to send, separated by a semi colon “;” and enclosed in single quotes ‘’.

--command_file

File with commands/configuration to pass to devices, separated by new line

-d, --devices

1 (or more) Device Number(s), space separated, must all be same device type.

-device_file

File with Device Numbers, separated by new line, must all be same device type

-o, --output_file

File to output results to, if none output is to STDOUT

--custom_credentials

Provide custom credentials for access to these devices (uses your TACACS credentials by default).

Command:

nscli fleet_tools mac

View MAC executed maintenances against devices.

Options:

-m, --maint

View a requested Maintenance

-q, --qc

View a requested Qc

-r, --run

View a requested Run

-i, --id

Id value of Mac execution.

FTD

FTD module is a parent module for FTD related sub-commands. All tools that relate to the FTD product line will fall here. YAML files can be generated by torq-firekick with the templates that start with _FTD. Most likely, one would create an SSH tunnel to bounce the https connection through a bastion to the FTD we are managing. Sample command:

nscli ftd nat -c nat.yaml -a 127.0.0.1 -u admin -p mypassword –port 8443

Command

nscli ftd flexconfig

nscli ftd nat

nscli ftd networking

nscli ftd objects

nscli ftd platform

nscli ftd secpol

Options

-a, --address

address (management ip) of the FTD we are managing

-c, --config_file

config file in YAML format

-p, --password

password

-P, --port

use this port for the API calls to the FTD

-u, --username

username to run the API commands against

-v, --verifytls

verify the FTD’s TLS certificate authenticity and validity

Goast

Perform Goast checks on a device. Goast (formerly ROAST) is a QC tool that runs through Rackspace stadard configuration items, and validates config compliance.

Command:

nscli goast $device

History

Lists tickets for the specified user within the last month

Command

nscli history

Options

-u

[user] Specify a user to pull ticket history for.

IDS

Alert Logic IDS related sub-commands

Command

nscli ids cert_list $account

Gather SSL Certificates installed on the CORE account provided

Options

-a, --al_account

Account provided is an Alert Logic account #, NOT CORE

-f, --filter

Filter returned certs matching a select word or phrase

-s, --ssl_tool

Provide additional details from SSLTool for each cert. ONLY LEGACY. NOT MDR.

Command

nscli ids cert_uploader $device $directory upload a local pfx to the associated Alert Logic account

of an Alert Logic IDS.

Options

-r, --recursive

Upload all PFX SSL Certificates found in the provided directory

-a, --al_account

Account provided is an Alert Logic account #, NOT CORE

-p, --password

Prompt for password to use for all certs

Imperva

Imperva related sub-commands

Command

nscli imperva mx_update $device Gather gateways and update DB for Imperva MX device nscli imperva snmp_check $mx_device(s) Process gateways on each MX to check the snmp status

Info

The info command is a set of utilities that will pull device information from core, port status from switch api, and configuration using the switch libraries.

Supported identifiers:

• <CORE Ticket>, example: 170117-07799

• <CORE ID>, example: 349763

• <IP Address valid in CORE>, example: 50.56.20.10

• DP-<Mydatapipe DeviceID>, example: DP-86926

• DP-<IP Address valid in mydatapipe>, example: DP-206.55.127.120

Command

nscli info $identifier [$identifier…]

Options

-s, --simple

Simple information print out, this will only include the device number, primary ip, and switch port information.

-p, --portinfo

Display the device information and port status using Switch API.

-m, --macinfo

Diplays the device information, port status and mac address information from Switch API.

-c, --config

NSCLI will attempt to gather the configuration for each device port, by logging into the switches.

-n, --nat

Inlcude the nat comments for each device. This will be a list of public and private IPs.

-e, --edge

Attempts to identify the edge device by using Switch API.

--portcompare

Runs bulk port comparisons against each other.

-t, --table

Represents tabular information when used after identifier(s) or shows a ‘summary table’ when used after any of -p/-pp/-pe/-pd options

-ip, --ip

Display ip assignments from env manager in tabular format

-D, --ip_vlan_details

Display detailed result of ip assignments and switch port-vlan info in tabular format

-sv, --sw_port_vlan

Display only switch port-vlan info in tabular format

ip

nscli ip can run ping, traceroute, public aggr and route checks.

aggr and routes functions are designed for use with Rackspace IPs.

ping and trace functions can be used with external IPs too.

the -c (ping count) and -t (ticket) flags are for the ping function only.

routes takes device numbers only.

Commands

nscli ip ping $core_device $ip $ip_block $ticket

Pings IP addresses.

Options

-c, --count

Works with the ping command. Lets you specify ping count.

-t, --ticket

Works with the ping command. Lets you ping devices on a ticket.

-l, --long

Works with the ping command. Show de response times.

-s, --store

saves the run state

-m, --compare

compare save state with the actual run

nscli ip aggr $core_device $ip $ip_block

Displays a table showing the current aggr.

nscli ip trace $core_device $ip $ip_block

Displays a traceroute for each IP.

nscli ip routes $core_device

Displays IP blocks routed to a device on the A and B aggr and pings each IP.

Options

-e, --em_blocks

Get routed block info directly from environment manager.

Juniper

Juniper module is a parent module for Juniper related sub-commands. All tools that relate to the Juniper product line will fall here.

Command

nscli juniper junospw Decode Junos encypted ‘$9$’ strings.

Options

-e, --encrypted-string

Non-interactive mode. nscli juniper junospw -e ‘$encrypted_string’ Note: Bash can sometimes attempt to interpret ‘special’ characters as commands. It is highly likely your string will contain these characters. Ensure your encrypted string is wrapped in single quotes (see above example), to avoid this happening.

Command

nscli juniper pt $device $source_ip $destination_ip $destination_port

Options

-s SPORT, --sport SPORT

source port (default is 1024)

-u, --udp

match udp (default tcp)

-c, --command

prints the juno match policy command only

-P, --public

Connect via Public IP.

-U USER, --user USER

Specify the user.

Command

nscli juniper sanitize pull $device

Pulls a config from a device and returns the sanitized version of it

Options

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli juniper sanitize input

Allows a raw config to be pasted into the terminal and returns the sanitized version of it

Options

-i INPUT_FILE, --input-file INPUT_FILE

Input a file instead of pasting to the terminal

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli juniper static_nats <network device> <List of individual IPs, pairs of IPs, or device numbers>

Preps or configures static address translations

Options:

-m, --manual

Makes the displayed commands usable in a copy/paste format for manual configuration

-p, --perform_changes

Performs the translation configurations on the network device.

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username, --username username

Specify a different username to log in with. Will prompt for passwords.

--no_dns, --no_dns_doctoring

Prep or configure translations without dns doctoring (only works with ASAs)

--no_qc

Prep or configure translations, even if they do not pass QC

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli juniper qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username

Specify a different username to log in with. Will prompt for password.

-v

Connects to Environment Manager and Core to return more detailed information about results

-vv

Connects to Environment Manager and Core to return more detailed information about results in CSV format

-t, --timeout

Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Luno_ng

Tool to utilise the Luno API. Some input checking is provided but engineers are responsible for their inputs

See LUNO wiki for details of commands in the LUNO NG client section or use -h.

https://raxglobal.sharepoint.com/sites/OneWiki-NetworkSecurity/SitePages/LUNO%20(Lazy%20Upgrade%20of%20Network%20Operating%20System)%20-%20F5%20Edition.aspx

Command

luno_ng f5_relicense -d <required>

Relicense using F5s external licensing server.

Command

luno_ng f5_upgrade_part1 -d <required>

Carries out upload and install of code, boot variable is not changed, includes validation.

Staging only (no reboot)

Command

luno_ng f5_upgrade_part2 -d <required>

Carries out reboot into new code with VIP checks, includes license check and validation.

Upgrade (includes reboot)

Command

luno_ng f5_upgrade_full -d <required>

Carries out install of already loaded code, includes VIP check, validation and re-license.

Command

luno_ng f5_clean_up -d <required>

Removes volumes except, live, target code, last two volumes installed.

Command

luno_ng f5_validate -d <required>

Carries out all validation checks covering upgrade caveats.

Command

luno_ng f5_status -d <required> -i <required>

Retrieves current or completed job status for jobs that are still in the DB for F5s, based on given job ID.

Command

luno_ng f5_volume_id -d <required>

Display volume name required by luno.

Options

-d, --device

Core device ID

-i, --id

Luno status ID (use only in f5_status at this time)

Example

luno_ng f5_upgrade_part1 -d 784223

MACAddress

Returns the device number and switchport associated to the MAC address if it can be found. The MAC address can be entered in any format.

Command

nscli macaddress <macaddress>

Options:

--silent

Disables printed messages during execution

Maint

Maintenance related plugins

Command

nscli maint asa

Script to automate migrating ASA platforms

Options

-c CURRENT_DEVICE, --current_device CURRENT_DEVICE

Current active/standby or single device

-n NEW_DEVICE, --new_device NEW_DEVICE

New primary or single device

--manual

Manual (offline) mode

-f FAILOVER_INTERFACE, --failover_interface FAILOVER_INTERFACE

Interface name for non-standard failover interface (e.g. GigabitEthernet1/6)

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Command

nscli maint asa_to_afm [DEVICE]

Convert ASA ACL’s to AFM

positional arguments:

device

ASA device number

Command

nscli maint cabling-audit [DEVICE] -t [TICKET]

Perform cabling audit to establish how device NICs connect to switch-ports.

CAUTION: use for breand new devices ONLY

DO NOT use on live/online devices as interfaces/switch ports associated will be WIPED / SHUT DOWN

Options

-t TICKET, --ticket TICKET

Core ticket number

-c Device:Console:Port [Device:Console:Port …], --console Device:Console:Port [Device:Console:Port …]

Device:Console:Port, once for each device, Example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016. | This ONLY applies for ASA/FP. | F5s need DRAC for code interaction.

--rcg

Treat RackConnect port as ExNet port. Should be used when RackConnect Global port is on the FW.

Command

nscli maint cyclade_asa_upgrade

Checks if software upgrade for ASAs on cyclade (console) is needed

and attempts to do change prep for upgrade by using KIR VLAN / DHCP.

By default, also checks for both code and anyconnect files versions on device

Options

-c Device:Console:Port [Device:Console:Port …], --console Device:Console:Port [Device:Console:Port …]

Console information for EACH device, in format ‘Device:Console:Port’ (space separated).

For example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016

-t 123456-78900, --ticket 123456-78900

Ticket number

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

-w, --webvpn_only

Check only for AnyConnect versions, not for code version.

-o, --code_only

Check only for OS code version, not for AnyConnect versions.

-v, --verbose

Verbose output for more step-by-step updates and feedback

Command

nscli maint decomm

Plugin to assist with cleanup of decommissioning automation tickets with failures.

DOES NOT apply to general decomm. work

Options

-t 123456-78900, --ticket 123456-78900

Ticket number (REQUIRED)

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Command

nscli maint escalation

Escalates ticket (may be depricated soon)

Command

nscli maint failover [DEVICE]

Generate failover testing plan (ASA, F5, ADX and PaloAlto)

Command

nscli maint freeze [DEVICE]

Add configuration freeze to network devices

positional arguments:

device

Device number (Active or Standby)

Options

-r

Remove config freeze sku

-priv

Use private comments

-t 123456-78900, --ticket 123456-78900

Ticket number (which will get ‘freeze’ updates)

Command

nscli maint ftd diff_asa

Diff FTD vs ASA config for migration prep / QC

Options

-a ‘/Users/asa.txt’, --asa_config ‘/Users/asa.txt’

REQUIRED. Local file with source ASA configuration (show run) for comparison

-f ‘/Users/ftd.txt’, --ftd_config ‘/Users/ftd.txt’

REQUIRED. Local file with converted FTD configuration (show run) for comparison

Command

nscli maint fw_convert

Convert firewall rules between ASA and F5 platforms

Options

-c CURRENT_DEVICE, --current_device CURRENT_DEVICE

Current device to convert

-d DESTINATION_DEVICE, --destination_device DESTINATION_DEVICE

Target device you want to convert to

-f FILE, --file FILE

Location of source config file

--manual

Manual (offline) mode

Command

nscli maint f5_license [DEVICE]

Generates maintenance steps in order to apply utilitu License

positional arguments:

device

Device number

Options

-g, --gtm

Provision GTM

-f, --afm

Provision AFM in ADC mode

-a, --avr

Provision AVR

Command

nscli maint lb_convert

Convert load-balancer configurations from Brocade ADX to BigIP-LTM or Citrix ADC.

Options

-d 123456, –device 123456

Source device number. Cannot be specified along with ‘-f’. MUST be ADX (at this time)

-f ‘/Users/config.txt’, –input_file ‘/Users/config.txt’

Local file with source device configuration. Cannot be specified along with ‘-d’. MUST be ADX (at this time)

-o (adc or ltm), –out_platform (adc or ltm)

Target LB platform. F5 LTM (ltm) or Citrix ADC (adc) (previously NetScalar)

--ns_dont_force_snat

Applies to Citrix NS/ADC conversion ONLY. For ADC configuration, SNAT will be ‘enforced’ as default configuration for ALL VIPS. If you need to stick to the settings in source configuration, pass this argument.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

-v, --verbose

Verbose output for more step-by-step updates and feedback

Command

nscli maint luno

Template for LUNO maintenances

Command

nscli maint migrate-ucs

Migrates configuration from current device to target device

Options

-c C

Current F5 device

-n N

New F5 device

--no_acs_add

DO NOT add device to ACS. Plugin will try to ADD given new F5 to the ACS. Use this flag to skip this step, if device has been previouly added

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call

Command

nscli maint minor

minor code upgrade prep for one of the following platforms: ASA, PaloAlto FW, F5, ADX, Citrix ADC (Netscaler)

Either -d or -o is required

Options

-d DEVICE_NO

Either active/standby device or single device

-o [palo], --offline [palo]

Only available for PaloAlto devices at this time. Offline mode to print generic steps.

-t TICKET_NO, --ticket TICKET_NO

Ticket number (to refer in maintenance plan). Does not work with ASA / ADX device type.

-b, --brief

Only applicable for PaloAlto devices. Print upgrade path ONLY and no prep / plan output

-u, --user

Login to devices using custom credentials in case it does not allow TACACS auth.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available).

DO NOT USE, unless you have a specific issue like timeouts / API failures.

Does not work with ASA / ADX device type. If not specified, cache is wiped with each call

Command

nscli maint nd_auto_parallel

Streamlines parallel migration process (ASA code only).

Process has following high-level steps:

cabling audit (run or parse results) -> ASA config. conversion -> ASA code upgrade (if needed)

-> switch changes > ASA config. apply -> parallel migration plan.

Options

-t 123456-78900, --ticket 123456-78900

Ticket number

-c Device:Console:Port [Device:Console:Port …], --console Device:Console:Port [Device:Console:Port …]

Console information for EACH device, in format ‘Device:Console:Port’ (space separated).

For example: 111111:con180-2.dfw3:7015 111112:con180-2.dfw3:7016

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

-s, --skip_ticket_update

Skips calls to external modules : OwnPrep, Freeze. This avoids duplicate updates while testing and repeat calls due to any issues with first run

-u, --skip_upgrade_check

Skips Code and Anyconnect version check step. This avoids duplicate checks while testing and repeat calls due to any issues with first run

-v, --verbose

Verbose output for more step-by-step updates and feedback

-x, --no_execute

Skips ‘auto-push’ over console and switch changes

-p <dfw or ord or..>, --proxy_bast_dc <dfw or ord or..>

Netbast DC location to proxy out for Console connection, if device DC cannot be used

--unipede_timeout

Set timeout value (in seconds, default = 300) for Unipede API calls, which NSCLI uses to get switch configuration data.

Use in case you see errors/timeouts during switch data processing phase.

Command

nscli maint palo base_config

Generate Base Palo Alto configuration to be used ASA to Palo Alto Migration

usage: nscli maint palo base_config [-h] (-m | -b) -n NEW_DEVICE_NO -t TICKET_NO [-S] [-A] [-k] [-c CURRENT_DEVICE_NO] [–testing]

Options

-m, --migration

Indicates that this is an ASA -> PA migration

-n, --newbuild

Indicates that this is an brand-new PA build

-c CURRENT_DEVICE_NO, --current_fw CURRENT_DEVICE_NO

Current FW core device number. REQUIRED IF it’s a migration

-n NEW_DEVICE_NO, --new_fw NEW_DEVICE_NO

REQUIRED. New Palo Alto core device number(s)

-t TICKET_NO, --ticket TICKET_NO

Core ticket number

-S, --skip_code_upgrade

Skip code upgrade check / steps generation (‘maint minor’ call)

-A, --skip_aggr_check

Skip Aggr / MAC ID discovery for automatic HA group determination. Needed if PAs don’t connect to normal RXT aggr topology / colo switches etc.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

--testing

DO NOT USE. Skips some validations / calls to allow faster testing

Command

nscli maint palo parse_asa

Prepare ASA configuration to be fed into Expedition tool for migration.

It removes RAX kick and adds some ACL changes to facilitate migration

Also may create some Palo configuration commands (for NAT etc) based on ASA configuration.

usage: nscli maint palo parse_asa [-h] (-s ASA_DEVICE_NO | -o) [-v] [-k]

Options

-s ASA_DEVICE_NO, --source_asa ASA_DEVICE_NO

Source ASA core device number(s)

-o, --offline

Offline mode. ASA configuration is gathered from local files.

-v, --verbose

Provide step by step details of the tasks being done.

-u, --user

Login to devices using custom credentials in case it does not allow TACACS auth.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Command

nscli maint palo post_exp

Fix up configuration given by Expedition migration tool to apply on PA

Options

-f LOCAL_FILE_PATH, --file LOCAL_FILE_PATH

REQUIRED. File with configuration (set commands) given by Expedition migration tool

-v, --verbose

Provide step by step details of the tasks being done.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available).

If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Command

nscli maint parallel

Maintenance generator for Parallel migrations v2

Options

-c

Current network device

-n

New network device

-t

Ticket Number

Command

nscli maint port-audit

Port audit for ticket or list of devices

Required Options (choose 1)

-t , --ticket

Ticket number to gather the device list from

-d , --device

Space delimited device list

-u , --update-switch

Force Unipede to update for a single switch/aggr and then ends

Additional Options

-f, --force

Force Unipede to refresh all switch and aggr data

-y

[ …], –porttype [ …] Include ONLY specified port type(s) in results, exclude ones not specified. e.g drac public

-l, --logs

Pull the switch-port logs for ports involved

--full

Full table including Speed/Duplex

-v, --verbose

Verbose output for more step-by-step updates and feedback

-nc, --nocompact

Adds blank lines to the table output for easier reading

-all, --downstream

Includes downstream switches in the table output

-noenv, --noenvironmentcheck

Skips the ENV check from the DCX API

-pt, --print-to-ticket

Print output to ticket private comment instead of terminal

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Command

nscli maint port-migrate

Assists in switch-port configuration for migrations (copy port settings from one device to another)

Options

-t 123456-78900, --ticket 123456-78900

Ticket number (REQUIRED)

-r, --replicate_ports

New device(s) ports set up ‘same as’ current reference device. Required co-arguments specified below.

-m, --migration_ports

Existing device moving to new location (cab migration, migration ports in core). Required co-arguments specified below.

-u, --user_mapping

Provide port mapping manually. Core migration port designation is ignored.

-s, --self_review

Print summary comparison table for SELF QC/review by person who ‘prepped’ the changes. This ONLY applies if data from previous run (where prep was done) is in ‘cache’ folder. ONLY needs -t, and ignore other arguments.

-q, --qc_table

Print switch port mapping and configuration comparison table for QC/review. No CHANGE PREP is done with this option. TO BE USED WITH ‘-r or -m’ (with appropriate co-arguments). Will be IGNORED with -s

--qc_with_cache

Only valid with -q/--qc_table option. In case switch info. gathering calls are FAILING, use this option to enable ‘caching’ for attempting to reduce API/ Switch login issues

-a, --allow_up_ports

Allow target ‘switch ports’ to be ‘UP’ during initial checks

-e, --enable_ports

Enable target ‘switch ports’ post changes. They are left in disabled state by default.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

--no_drac

Exclude DRAC ports for the prep. DRAC ports are included in changes by default. Has same effect as: –exclude drac

--exclude service_1 [service_2 …]

List of ‘port types’ or ‘services’ to exclude from mapping / configuration. Like drac, rackconnect etc. Matches service names that contain keywords from exclude list.

--port_description {none | maint}

By default, server name will be used as port description on target ports. You can choose ‘none’ for no description or ‘maint’ for description as ‘MAINT-<TKT NO>.

--speed_duplex

You will be prompted for speed/duplex settings for each switch port TYPE

--vlan_mapping

You will be prompted for VLAN mapping. To be used for ‘zone-migrations’

-x, --no_execute

Skips ‘auto-push’ for switch changes

-v, --verbose

Verbose output for more step-by-step updates and feedback

-r/--replicate_ports expects following arguments:

-c 111111, --current_device 111111

Current device (Source of switch configuration)

-n 222222 [222222 …], --new_device 222222 [222222 …]

New device(s) (Target(s) of switch configuration)

-m/--migration_ports expects following arguments:

-d 123456 [123456 …], --devices 123456 [123456 …]

Devices with migration ports

-p, --ports

Optional. Designate migration ports manually, if they are not marked in CORE.

Command

nscli maint port-migrate-old

Print commands to configure migration ports including trunking, vlandb etc.

Options

-h, --help

show this help message and exit

-d [DEVICES …], --devices [DEVICES …]

Input device numbers that have migration ports(ex. device device etc)

-t 123456-78900, --ticket 123456-78900

Ticket number

-m, --manual

Manual Port mapping for Migration

-n, --notes

Add sections for notes in the prep

-p, --para

Prep ports in shutdown for staging parallel otherwise ‘no shutdown’ is assumed

-g, --gig

Override speed with 1000MBPS

--auto

Override speed/duplex with auto/auto

--diff

Only return config changes for interfaces that aren’t identical

--diff-ignore-speed-duplex

Only return config changes for interfaces that aren’t identical, excluding speed/duplex from the diff

--dc DC

Specify DC (only for --manual)

-i, --info

Only return port-mapping

-q, --quick

Don’t force a config refresh in unipede

--ignore-up

CAREFUL This ignores up interfaces

--vlan-map

Allows for vlan map if vlans are changing

--bugs

List known issues with the script

Command

nscli maint prep

Prints a generic maintenance prep template

Command

nscli maint protected_ips

Prints pool members that should be added as protected ips on a WAF

Command

nscli maint qc asa

Assists in QC for ASA to ASA migrations

Options

-single

Print asa single to single parallel migration qc template

-single-ha

Print asa single to ha parallel migration qc template

-ha-ha

Print ha to ha parallel migration qc template

-directswap_single

1 for 1 direct swap for single device

-directswap_ha

1 for 1 direct swap for ha devices

-t Ticket, --ticket Ticket

Auto-QC for asa parallel migrations

-u acs | custom | rax, --user acs | custom | rax

By default, RAX default credentials (‘rax’) will be used to log-in to FW on console. You can choose ‘acs’ to use YOUR ACS credentials OR ‘custom’ to get prompted for credentials instead, if needed.

-c Device:Console:Port [Device:Console:Port …], --console Device:Console:Port [Device:Console:Port …]

Device:Console:Port, for example: 111111:con180-2.dfw3:7015. This ONLY applies for ASA code QC. Provide for PRIMARY FW ONLY. NO need for HA pair details.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call

Command

nscli maint qc f5

QC steps for F5 parallel migrations

Options

-h, --help

show this help message and exit

--single

QC steps for F5 single to single parallel migration

--single-ha

QC steps for F5 single to ha parallel migration

--ha-ha

QC steps for F5 ha to ha parallel migration

--afm_single

QC steps for F5 afm single to single parallel migration

--afm_ha

QC steps for F5 afm ha to ha parallel migration

-u, --user

By default, ACS/TACACS credentils will be used to log-in to the F5. If you need to use different login, use -u flag. You will be prompted to provide user-id / password.

-t Ticket, --ticket Ticket

Auto qc for f5 parallel migrations

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call

-c current_device, --current_device current_device

Current Device Number

-n new_device, --new_device new_device

New Device Number

Command

nscli maint rcv3

Maintenance templates for Rackconnectv3

Positional arguments

device

RCv2 connected device of the environment

Additional Options

-v2, --version2

Template for RCv2 to RCv3 maintenances

-cleanacl

Provide commmands to cleanup outside ACL after v2 to v3 upgrade

Command

nscli maint qc generic

Prints generic qc steps

Command

nscli maint qc para

Prints qc steps for parallel migrations

Command

nscli maint sweep

Allows Ping sweeping IPs behind an edge device. Uses NAT’s (if possible) else Routed IP blocks are used

Options

-n, --add-nats

Also print the NAT (if available)

-t TICKET_NUMBER, --print-to-ticket TICKET_NUMBER

Also output the table to a ticket

-s, --store

Store results for later comparison

-c, --compare

Compare live results against stored results

-b, --blocks_only

Skip NAT evaluation, use Routed IP blocks for scanning

Command

nscli maint sw

SwitchRunner API

Options

status

List/Enable/Disable switch ports

Option arguments

-l, --list

list switch port status

-m [enable|disable], --modify [enable|disable]

modify switch port status.

-t TICKET, --ticket TICKET

Core ticket number

-d DEVICE, --device DEVICE

Core device number

-sw SWITCH, --switch SWITCH

switch

-i [INTERFACE [INTERFACE …]], --interface [INTERFACE [INTERFACE …]]

interfaces separated by space. Example gi0/8 gi/09

Command

nscli maint times

Print standard maintenance times

Command

nscli maint updates

Generates prefabs used for maintenance process

Options

-mrt

Prefab for waiting on prep

-mrt_v2_3

MRT for v2 to v3 upgrades

-mrt_afm

MRT for AFM related maintenances

-waitprep

Prefab for waiting on prep

-waitqc

Prefab for waiting qc

-ownprep

Prefab for owning Prep

-ownqc

Prefab for owning qc

-sched

scheduling prefab

-qcsched

Prefab for owning qc + scheduling

-waitqcsched

Prefab for waiting qc + scheduling

-qcpass

Update ticket with official NetSec QC Pass

-escalate

Escalate ticket

--ticket TICKET

Update ticket with prefab: usage –ticket <ticket_num>

-nd

Updated ticket with network defense signature

-priv

Update ticket privately

Migrations

Migrations sub-commands are quick scripts, audits, and actions that pertain to data-center migrations.

Command

nscli migrations validate $collection $devices Validate source dest switchport configs

Options

-a AGE, --age AGE

Unipede age. default: 86400 sec

--no-errors

Only print config issues and not errors to screen

Command

nscli migrations finalize_migration $device Finalize migration switchport configs

Options

-C, --switchport-copy

Run switchport copy after finalize

Command

nscli migrations finalize_current $device Finalize current switchport configs

Command

nscli migrations startup $device Prep NetDevice startup config for DC migration shutdowns

Options

-b, --no-backup

Do not run a TORQ backup prior to executing

-t, --test

Only print payload, do not run

--management-ip

Pass different management IP address

Command

nscli migrations update_waf $device Re-IP ServiceNet for Imperva WAF’s using migration IPs

Options

-t, --test

only print payload, do not run

Command

nscli migrations f5_trust Rebuild device trust between two F5s (prompts for devices)

Options

-t, --test

only print payload, do not run

-p, --password

specify a unique local admin password to attempt

Command

nscli migrations info $collection $device Pull information from the MigrationDB

Command

nscli migrations reserve_ip $device $ip_address Reserve a migration IP address (marks reserve flag in Commander)

Command

nscli migrations refresh $collection $source Refresh data in the Migrations Database

Options

-D, --device

Refresh a device

-A, --account

Refresh an account

Command

nscli migrations status $device Get port status and reachability for a device

Options

-p, --no-ping

don’t run aggr ping and just return ports

Command

nscli migrations mirror_ports $device Gather span-sessions for a given device/account/move-group

Options

-D, --device

Gather for a device

-A, --account

Gather for an account

-M, --move-group

Gather for a move-group

-a, --age

Unipede age. default: 86400 sec

Command

nscli migrations zones Zone lookup of all migration up-links

Command

nscli migrations auto_discover $environment True-up Environment Manager device+vlan / port+segment associations

Options

-M, --make-changes

make production changes, this WILL make changes in EM

Command

nscli migrations audit type Run audits against migrations data

Command

nscli migrations vlans $env_or_device Pull DCX Vlan and relationship information

mirror

Mirror related sub-commands

Command

nscli mirror login Logs you into the NetSec code mirror (requires access to the NetSec DevOps PasswordSafe)

Command

nscli mirror search $filename Searches the NetSec code mirror for a specific filename(s)

monitoring

Plugin that allows to obtain checks, alarms and suppression information given a device. Moreover, plugin provides the option to copy alarms from one device to another device (parallel migrations)

Command:

nscli monitoring $device

Options:

-d, --display-alarms

Display device alarms

-c, --copy-alarms

Copy alarms from existing device to new device

-t TARGET_DEVICE, --target-device TARGET_DEVICE

Target device

Example

nscli monitoring 689684 -c -t 689680

Ndapi

This is an example of the device api we are building to support our current and future automation efforts. Given the platform, device number and a full command the api will attempt to run it if it’s a valid parser and return you the output in json format.

Command

nscli ndapi $platform -d $device_number -r $command

Example

nscli ndapi asa -d 550883 -r show version

Netbast

The netbast option will log you into the netbastion, NSCLI will use your tacacs password if your key is not on the bastion.

Command

nscli netbast $DC

Options:

-1, --net1

Force connection to 1st Netbast in Datacenter.

-2, --net2

Force connection to 2nd Netbast in Datacenter.

-3, --net3

Force connection to 3rd Netbast in Datacenter.

Netscaler

Netscaler module is a parent module for netscaler related sub-commands. All tools that relate to the Citrix Netscaler will fall here.

Command

nscli netscaler sanitize pull $device

Pulls a config from a device and returns the sanitized version of it

Options

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

Command

nscli netscaler sanitize input

Allows a raw config to be pasted into the terminal and returns the sanitized version of it

Options

-i INPUT_FILE, --input-file INPUT_FILE

Input a file instead of pasting to the terminal

-o OUTPUT_PATH, --output-path OUTPUT_PATH

Path to folder where to save the file instead of printing to the terminal

-d, --desktop

Save file to ~/Desktop instead of printing to the terminal (Saves to nscli cache directory if Desktop does not exist)

NLA

The NLA (Network Level Authentication) option will allow you to interact with the Rackspace cut-through proxies to either login, logout, or view status per datacenter.

Command

nscli nscli status $dc

Command

nscli nscli login $dc

Command

nscli nscli logout $dc

PA

PA module is a parent module for Palo alto related sub-commands. All tools that relate to the PA product line will fall here.

Command

nscli pa group get

Get HA-GroupId information from FACTS PA HGID application

Options

-d DEVICE, --device DEVICE

Device number to get HA-GroupId entry for

-a, --all

Get a CSV file for ALL entries in the PaloAlto HA GroupID database.

-s, --search

Find entries in the PaloAlto HA GroupID database.

-D DC_NAME, --datacenter DC_NAME

Must be used with ‘-s/–search’ to find entries for given DC in the PaloAlto HA GroupID database.

-A ACCOUNT_NUMBER, --account ACCOUNT_NUMBER

Must be used with ‘-s/–search’ to find entries for given account number in the PaloAlto HA GroupID database.

-G AGGR_NAME, --aggr AGGR_NAME

Must be used with ‘-s/–search’ to find entries for given AGGR in the PaloAlto HA GroupID database.

-V VLAN_ID, --vlan VLAN_ID

Must be used with ‘-s/–search’ to find entries for given VLAN ID in the PaloAlto HA GroupID database.

-e ENV_TYPE, --env ENV_TYPE

(For testing purpose only). Choose env to get data from; local | staging | prod

-f TOKENFILE, --tokenfile TOKENFILE

(For non prod environment only) File path to read the custom identity token

-u URL, --url URL

(For testing purpose only) Custom url for Facts API to make request to get job status and details.

Command

nscli pa group create

Create HA-GroupId entry in from FACTS PA HGID application

Options

-d DEVICE, --device DEVICE

Device to create HA-GroupId entry for

-D, --discovery

If provided, turns discovery OFF. Then, Aggr & VLAN has to be provided to create HA-GroupId entry.

-a AGGR, --aggr AGGR

Aggr for the HA-GroupId entry when discover option is False

-v VLAN, --vlan VLAN

Vlan for the HA-GroupId entry when discover option is False

-g GID, --gid GID

GroupID for the HA-GroupId entry when discover option is False

-e ENV_TYPE, --env ENV_TYPE

(For testing purpose only) Choose env to get data from; local | staging | prod

-f TOKENFILE, --tokenfile TOKENFILE

(For non prod environment only) File path to read the custom identity token

-u URL, --url URL

(For testing purpose only) Custom url for Facts API to make request to get job status and details.

Command

nscli pa group update

Update HA-GroupId entry in from FACTS PA HGID application

This command is a placeholder and cannot be run in this current NSCLI version.

Command

nscli pa group delete

Delete HA-GroupId entry from from FACTS PA HGID application

This command is a placeholder and cannot be run in this current NSCLI version.

Command

nscli pa group status <job_id>

Check the status/results of a group-id request with given job-id

Options

-e ENV_TYPE, --env ENV_TYPE

Choose env to get data from; local | staging | prod

-f TOKENFILE, --tokenfile TOKENFILE

(For non prod environment only) File path to read the custom identity token

-u URL, --url URL

(For testing purpose only) Custom url for Facts API to make request to get job status and details.

Command

nscli pa qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username

Specify a different username to log in with. Will prompt for password.

-v

Connects to Environment Manager and Core to return more detailed information about results

-vv

Connects to Environment Manager and Core to return more detailed information about results in CSV format

-t, --timeout

Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

PassGen

Passgen tool is a command-line quick-tool that will provide a random password within NSCLI. Default behavior will generate a 30 character password with uppercase, lowercase, numbers, special character types.

Command

nscli passgen

Options:

-c, --length LENGTH

Length of password to generate (Default: 30)

-a, --add ADD

Add characters to the generator

-l, --no_lower

Remove lowercase letters from passgen.

-u, --no_upper

Remove uppercase letters from passgen.

-s, --no_special

Remove special characters from passgen.

Permissions

Permissions tool is a command-line quick-tool that queries customer permissions

Command

nscli permissions

Options:

-t TICKET, --ticket <TICKET>

user permissions of devices attached to ticket

-d, --device <DEVICE [DEVICE…]>

user permissions give a list of devices

Projects

Lists projects for a team (defaults to Maintenance Team)

Command

Options:

-t

Show projects for a specific team

-a

Shows all tickets for given team including Unassigned

-1, --single_threaded

Runs 1 core call at a time. By default, core calls are made in parallel (for ticket batches) for faster processing.

-s, --support_tiers

Tier information from wiki will be used in output: https://raxglobal.sharepoint.com/sites/Onewiki-support/SitePages/GTS%20Queues%20and%20Views%20-%20Tier%20Change%20Requests.aspx By default, Tier information from ‘Encore’ is used otherwise.

-m, --am_names

RUNS SLOWER. Adds account manager’s + AM’s manager’s name in the output.

-c, --core_data

RUNS SLOWER. DO NOT USE YET. Adds core lookups for data like ‘is_us’ or ‘NetSec Team’ for account.

-k, --keep_cache

Keep and Use cached data for functions from previous call (if available). If not specified, cache is wiped with each call. DO NOT USE if you are unsure, as this is mainly aimed at debugging/troubleshooting.

Provisioning

These are the collection of utilities to perform various provisioning related tasks

Command

nscli provisioning add devices <environment number> <list of devices>

Adds device(s) to the specified environment

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning add environment <list of devices>

Creates a new environment based on devices listed

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning add gateways <list of devices>

Modifies and adds the listed devices as gateways in an enviroment

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning add svi <ENV or ZN>

Documents and configures a shared or dedicated SVI. ENV denotes dedicated, ZN denotes shared

Options:

-n, --network_address

Specifies a network address for identifying a public block to use

-p, --prefix_length

Specifies a cidr notation required for the public block, default 29 for dedicated, 27 for shared

-v, --vlan_number

Specifies a certain VLAN to use for the SVI

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning add vlan <environment number> <vlan name>

Adds a VLAN to an enviroment

Options:

-v, --vlan_number <1-4094>

Specify a specific VLAN Number

-b, --private_ip_block <172.24.16.0/22>

Specifiy an Optional private IP block CIDR to create and associate to the VLAN

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning assign ip [‘interactive’]|[<type> <device ID> <ip|block|auto> [role] [ip|block|vlan] [role] [SVI]]

Assigns IP(s) to a device or devices

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning assign vlan <vlan number> <list of devices>

Assigns a VLAN to a list of devices’ switchports, or just the devices if they are virtual

Options:

-m, --match <1E, 2E>

Only adds the VLAN to switchports with a switch contains this match field

-p, --port

Only assigns the VLAN(s) to switch and port specified. Requires switch to be specified.

-s, --switch

Only assigns the VLAN(s) to switch and port specified. Requires port to be specified.

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning batch get_ip <env_number>

Generates a CSV in the Batch IP format based on the existing environment data

Options:

-f, --file <file_name>

Outputs to a file instead of the console

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli provisioning batch get_vlan <env_number>

Generates a CSV in the Batch VLAN format based on the existing environment data

Options:

-f, --file <file_name>

Outputs to a file instead of the console

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli provisioning batch ip <list of devices>

Creates Environment Manager Batch CSV to add public and/or private IPs devices and assigns their roles

Options:

-n, --public_ips <any, 1.2.3.4/29, 1.1.1.1, list_of_IPs>

Specifies the requested public block(s). Use “any” to specific that a public block is needed but to use any available public IP in the environment. More than one public block can be specified, separated by a space.

-p, --private_ips <172.24.16.0/22, 10.0.0.1, list_of_IPs>

Specifies the requested private IP(s) or block. You can specify more than one IP or block

-l, --label <gateway, primary, reserved_gateway, drac>

Defines the IP address as a primary, DRAC, gateway, or reserved gateway address. Default label is “none”

-f, --use_first_available

Finds the first available private IP by default when a block is specified

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning configure nats <network device> <List of individual IPs, pairs of IPs, or device numbers>

Preps or configures static address translations

Options:

-m, --manual

Makes the displayed commands usable in a copy/paste format for manual configuration

-p, --perform_changes

Performs the translation configurations on the network device.

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username, --username username

Specify a different username to log in with. Will prompt for passwords.

--no_dns, --no_dns_doctoring

Prep or configure translations without dns doctoring (only works with ASAs)

--no_qc

Prep or configure translations, even if they do not pass QC

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli provisioning info devices <list of devices>

Gathers basic information about devices

Options:

--staging

This will force the use of staging APIs instead of production APIs

-f, --filter

Only show network information about the specified filter

-v

Returns basic device information plus network information

-vv

Returns basic device information plus detailed network information

--csv

Returns the output information in csv format

--silent

Disables printed messages during execution

Command

nscli provisioning info kir_validate <list of devices>

Checkes devices for KIR validation errors

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning info switch_prep <list of devices>

Displays organized switchport information for devices

Options:

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli provisioning info ndpqc <network device>

Options:

-f, --fails_only

This will only output checks that fail

-t, --ticket

Post the network device QC results to the specified ticket

-u username, --user username

Specify a different username to log in with. Will prompt for password.

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli provisioning info qcip <network device> <list of devices, IP addresses and/or IP blocks>

Options:

-s, --srm

Adds disabled interfaces to the known routes to better identify segments for SRM environments

-u username, --user username

Specify a different username to log in with. Will prompt for password.

-v

Connects to Environment Manager and Core to return more detailed information about results

-vv

Connects to Environment Manager and Core to return more detailed information about results in CSV format

-t, --timeout

Specifies a ping timeout value. Defaults to 0 seconds. Does not work on F5 or SRX.

--silent

Disables printed messages during execution

--staging

This will force the use of staging APIs instead of production APIs

Command

nscli provisioning remove devices <list of devices>

Removes devices from an enviroment

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning remove gateways <list of devices>

Modifies and removes the listed devices as gateways in an enviroment

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Command

nscli provisioning unassign vlans <vlan numbers> <list of devices>

Unassigns VLAN(s) from a list of devices

Options:

--staging

This will force the use of staging APIs instead of production APIs

--silent

Disables printed messages during execution

Qcip

*DEPRECATED.* Will qc an IP address based on a list of comma seperated public, private IPs or a ticket number. This requires you to sepecify the edge device and only supports ASA. This will only check connected networks and will warn if it is not local.

Command

nscli qcip $fw_number $publicip,privateip … nscli qcip $fw_number $device … nscli qcip $fw_number $ticket

RC

RackConnect related sub-commands

Command

nscli rc report $account

Show RackConnect instances for the dedicated Account

Options

-s, --summary

Show summarized information only

-j, --json

Output as JSON

-f, --file

Save the output in the specified filename

Command

nscli rc finder $account $string

Search for the specified keyword in the following fields: Public/Private IP, instance name and API_ID

RCG

Rackconnect Global related sub-commands

Command

nscli rcg info a $account

Show instances with Rackconnect Global Sku the dedicated Account

Options

-h, --help

show this help message and exit

-d, --detail

print detailed output

-s SKU, --sku SKU

filter server in an account based on SKU numbers

Command

nscli rcg info t $ticket_number

Lists the instances with RackConnect Global SKU that are attached to ticket.

Options

-h, --help

show this help message and exit

-d, --detail

print detailed output

Command

nscli rcg nets

Extract network from show route connected/static output

Options

-h, --help

show this help message and exit

--paste

Paste the output of show route connected and static

--filename FILENAME

Filename with output

Reset

This will delete any cached secrets, tokens, session data, or infrastructure config, and also delete your sso_user and acs_user settings from your settings file. NSCLI will re-prompt you for these credentials the next time it needs them.

rlookup

Runbook Lookup related sub-commands

Command

nscli rlookup [-a] $account_number [-b]

Options

-a, --account

Enter Core Account Number

-b, --browser

Boolean argument to open runbook in browser, default False

runner

The runner option will allow you to run one or more commands in a periodic/repetitive way against net devices. Currently supported devices are Palo Alto, ASA, F5 and Netscaler. You can specify either number of times command will be executed or total duration of command execution. If not specified any value, command(s) will be executed only once.

Command:

nscli runner DEVICE_NUMBER [-h] [-t TICKET_NUMBER] [-i INTERVAL] [-r REPEAT | -a AGE] (-c COMMAND [COMMAND …] | -f LOCAL_FILE_PATH | -m)

Positional arguments:

DEVICE_NUMBER

Device Number

Options:

-t, --ticket [TICKET_NUMBER]

Ticket Number

-i, --interval [INTERVAL]

Time Interval in seconds. Must be greater than 3. You must specify -a or -r along with -i

-r, --repeat [REPEAT]

Number of times command needs to be executed/repeated. If not specified, command(s) will be executed only once

-a, --age [AGE]

Total duration of time (seconds) for script execution. If not specified, command(s) will be executed only once

-c, --command [COMMAND …]

Commands to be executed

-f, --file LOCAL_FILE_PATH

Location of the file that contains commands

-m, --manual

User interactive, it will prompt for commands to be executed while Runner plugin is in action

Settings

This will open NSCLI’s settings.ini file in your default text editor application.

Options

-u, --update

Set your settings back to defaults

-db, --db_update

Force refresh of config db

-g, --gateway

Set balabit gateway

-d, --dc

Set proxy DC

-e EMAIL, --email EMAIL

Set Rackspace email ID

-s, --sso

Set sso username

-t, --tacacs

Set tacacs username

--bash

Print a bash completion script

--zsh

Print a zsh completion script

-c, --cacerts

Installs Rackspace CA certificates

--details

Print details/comments of what setting file fields do.

SSH

The SSH option will attempt to connect to a device based on the core information by using the customer bastion to proxy the conneciton.

Supported Platforms: ADX, ASA, F5, SRX, RSA, WAF

Supported identifiers:

• <CORE ID>, example: 349763

• <IP Address valid in CORE>, example: 50.56.20.10

• DP-<Mydatapipe DeviceID>, example: DP-86926

• DP-<IP Address valid in mydatapipe>, example: DP-206.55.127.120

Command

nscli ssh $identifier

Options

-d, --drac

Connect to the device using the DRAC address. This is the default aciton for ADX and F5.

-p, --public

Connect to the device using the Public address. This is the default aciton for ASA, CSS, SRX, RSA, WAF

-n, --number_of_device

Display number of network devices connected and connect it through SSH

-e, --edge

SSH to the edge device

-u, --user

Prompt for the username and passwords to log into the device.

-g, --gui

Open up the GUI for the device. This only supports F5. For opening multiple sessions (tabs) at once, this module is compatible with Ghost Browser on Mac. Simply download the application and place it in your Applications folder.

-s, --scp

Interactive prompt allowing scp of files to and from a remote net device. Requests user to specify file transfer direction and source/destination filename and location.

-w, --waf

Use the WAF Password Safe information to log into the device.

-r, --rsa

Use the RSA Password Safe information to log into the device.

-f, --failover

login to the failover mate

--scp_method

Specify the scp method 1 = local to remote, 2 = remote to local (Used with -s, –scp)

--src_file

Specify the source file name (Used with -s, –scp)

--dest_file

Specify the destination file name (Used with -s, –scp)

-a, --attemptssh

attempt ssh connection to unknown device type. Requires use of -p or -d flags.

Swip

The swip command allows you to view and create/modify/remove ARIN information for IP blocks.

Format

nscli swip

Command

nscli swip (standalone will prompt for info) nscli swip -r x.x.x.x/29 y.y.y.y/29 (remove swip information) nscli swip –simple

Options

-m, --modify <IP/CIDR>

Quick switch to tell the prompted version you want to modify the current swip information

-n, --new <IP/CIDR>

Quick switch to tell the prompted version you want to create a new swip entry

-r, –remove <IP/CIDR> (supports multiple blocks)

Quick switch to tell the prompted version you want to delete the swip information for the provided subnets

-s, –simple (supports multiple forms all at once)

Allows user to paste in one or more arin simple forms to mass update arin information

-l, --lookup

Returns whois information for requested IP’s. This hits the arin whois server for information and NOT the API

--netname

Allows the user to override the autogenerated netname used when creating a new ARIN entry

--api-key

Returns the current API key the script is using to update ARIN

Switch

The switch command allows you to connect to a switch and has various other switch audits and utilities.

Format

Switch_Name.dc (case insensitive)

Command

nscli switch switch_name.dc

Example: nscli switch F9-19-1.DFW1

Options

-i, --info

Returns all switch port from core, this should include type, account, device number and device name

-p

Takes a list of space seperated numbers and only returns the information for those ports, this can be used with the -i flag or by itself.

-v

Given a list of space seperated vlans NSCLI will attempt to the log into the switch and indentify all ports where the vlan is active by spanning tree and log on to any neighbor switches. The result will include any Core information or interface number where the vlan is being used.

-r

This option allows you to run a single command on the switch and exit, the command can be space seperated or if you want to use the | option on the switch the command should be in quotes.

-V

VPC audit, you can request ‘all’ or a give NSCLI a list of space seperated port-channel numbers. The ‘all’ option will return all the ports that are in a bad state, individual numbers will return the correct or error depending on the port-channel state.

Ticket

The ticket info will retrieve device information from a list of tickets.

Command

nscli ticket $ticket_number $ticket_number …

-s, --simple

Simple information print out, this will only include the device number, primary ip, and switch port information.

-p, --portinfo

Display the device information and port status using Switch API.

-m, --macinfo

Diplays the device information, port status, and mac address information from Switch API.

-c, --config

NSCLI will attempt to gather the configuration for each device port by logging into the switches.

-n, --nat

Inlcude the nat comments for each device. This will be a list of public and private IPs.

-e, --edge

Attempts to identify the edge device by using Switch API.

--addenv

Attaches all devices from an environment to the ticket.

--listonly

Only lists the devices instead of attaching to the ticket. Use with –addenv.

TLS

Graphical plugin for creating TLS cipher configurations for F5’s, ADX’s, and ASAs. Supports all common device code versions.

Command:

nscli tls

tshoot_access

Troubleshoot access to network devices from NSI automation. Currently works with ASAs only.

Command

nscli tshoot_access $device

Torq

Use the Torq API to download net device backups, register new devices to Torq, or cause Torq to refresh its device info.

Command

nscli torq get-file <device_id> <filename> [–metadata]

device_id

The CORE device number

filename

The name of the file to download, e.g. running-config or version

--metadata

Display file metadata followed by file contents. Default: contents only

Command

nscli torq list-files $device_id

device_id

The CORE device number

Command

nscli torq backup $device_id

device_id

The CORE device number

Command

nscli torq add-device $device_id

device_id

The CORE device number

Command

nscli torq refresh-device $device_id

device_id

The CORE device number

Tokens

Use the TOKENS plugin to print or set your identity or core token

Command

nscli tokens [-h] [–core] [–identity]

Options

-c, --core

Print core token

-i, --identity

Print identity token

-cf, --cloudflare

Print Cloudflare API key value from NSCLI token

-imp AccountNumber, --impersonation_token AccountNumber

Print customer impersonation token

-m, --managed_cloud_pass

Print password for 3rd party, managed cloud net devices

-s --set_tokens

Set core or identity token

Trunking

Use the TRUNKING plugin to assist in trunking down vlans

Command

nscli trunking autotrunk [-h] [–v] switchport vlan vlan_name

Options

--v

Verbose mode. Can be used multiple times to increase logging level.

switchport The switchport to trunk down the Vlan to. i.e. d13-3-1e.ord1[5]

Can also support multiple switchports seperated by a comma. Example: d13-3-1e.ord1[5],d13-4-1e.ord1[5]

vlan The vlan to trunk down. i.e. 1000

Supports multiple vlans separated by commas if the port or ports are access ports. Example: 1,2,3,4,5,6,7,8,9

vlan_name The name of the vlan you are trunking down. i.e. “VLAN_NAME”

If multiple vlans are specified, you are required to specify a name for each vlan. Example: “VLAN_NAME_1,VLAN_NAME_2,VLAN_NAME_3”

Virt

Virtualization subsection of nscli

Command

nscli virt port-audit Same as ‘nscli maint port-audit just makes it easier for virt to find

Command

nscli virt cdp-update Generate RPCV dns entries for Public and CDNS

Options

-t, --ticket

Ticket used for device list

-d, --device

List of devices to enable cdp on

--disable

Return the disable commands instead of the enable commands

Command

nscli virt gendns Generate RPCV dns entries for Public and CDNS

Options

-t, --ticket

Ticket used for device list

-d, --device

List of devices to generate dns entries for

Command

nscli virt genmon Generate RPCV monitoring as well as updates guidelines if necessary

Options

-t, --ticket

Ticket used for device list

-d, --device

List of devices to generate dns entries for

-c, --check

Only checks the account guidelines and monitoring to see if the checks exist

-u, --user

Override the default impersonation user

Command

nscli virt port-check Checks Hyp ports for cabling and vlan configuration

Options

-t, --ticket

Ticket used for device list

-d, --device

List of devices to generate dns entries for

-p, --public

Uses the public IP of the Hyps for the check. This is used for RPC-V Builds

-f, --force

Forces latest information from unipede

-o, --oneline

prints output of vlans on oneline

Command

nscli virt rpcv-acl Generate ACL’s required for RPC-V

Options

-t, --ticket

Ticket number

-d, --device

List of devices to check

--no-verify

Ignore IP validation

-v, --verbose

Add verbose information

--v2

Switches logic back to the old v2 logic

--asa

Tells the script to generate the configuration for an ASA

--f5

Tells the script to generate the configuration for an Edge F5

--palo

Tells the script to generate the configuration a Palo on the Edge

Command

nscli virt trunking device_id -> audit or generate trunking commands to all hypervisors in cluster

device_id - this can be one or multiple devices separated by space.

Options

-m, --manual

specify hypervisor(s), vlans to trunk or audit

-t, --trunk

Provides commands to trunk vlans, Vcenter API is called to get all hyps in cluster

-a, --audit

check for missing vlans in cluster; Vcenter API is called to get all hypervisors, and vlans

Voyage

Interface for Voyage (bulk ARIC task execution)

Command

voyage migrations

Lists all the current migration with their id and name

voyage milestones list $migration_id

Lists the milestones of a migration, with their order, name, id and device count

sync $migration_name

Tells Voyage to update it’s database from the data in the NS DB.

WAF

Imperva WAF related sub-commands

Command

nscli waf cert_uploader $device $directory upload a local pfx to the associated server groups

of an Imperva WAF on an MX

Options

-r, --recursive

Upload all PFX SSL Certificates found in the provided directory

-c, --choose

Choose which Server Group to upload certificate(s) to

-p, --password

Prompt for password to use for all certs

Command

nscli waf protected_ips $device $address Determine if IP is part of WAF protected IPs

Options

-s, --show

Show IPs from each server group

Command

nscli waf info $device Provide hardware and Securesphere configuration

Command

nscli waf cert_list $device Gather installed SSL Certificates from an Imperva WAF

Options

-s, --simple

Don’t provide certs in a tree view. Return a simple list.

-d, --detailed

Return detailed information about each cert

Command

nscli waf violations $device Gather installed SSL Certificates from an Imperva WAF

Options

-d DAYS, --days DAYS

Number of days back to search. Default of 1 day if not defined.

-l LIMIT, --limit LIMIT

Limit results to a defined number. Note this is PER SERVER GROUP

-i SOURCE_IP, --source_ip SOURCE_IP

Filter for a specific source IP

-a ALERT_NUM, --alert_num ALERT_NUM

Filter for a specific Alert number

-e EVENT_ID, --event_id EVENT_ID

Filter for a specific Event ID

-s [informative, low, medium, high], --severity [informative, low, medium, high]

Filter for severity

-o OUTPUT_DIRECTORY, --output_directory OUTPUT_DIRECTORY

Output to csv file at specified directory. Ex: ~/Downloads. A file named ‘violations.csv’ will be created.

-u URL, --url URL

Filter URL EQUALS. Must be full path. ex: /html/public/index.php

zenoss-download

Download graphs from Zenoss and make a PDF.

-h, --help

shows help

-r, --reset

Reset configuration

-d, --device

Enter device list separated by comma

-t, --ticket

Enter Ticket Number

-a, --account

Enter Core Account Number

-v, --version

Show version

-D, --debug

Debug

-stime, --start-time

Enter date/time when you want graph to start, Format 2017-10-10,15:00 YYYY/MM/DD (UTC)

-etime, --end-time

Enter date/time when you want graph to end, Format 2017-10-10,18:00 YYYY/MM/DD (UTC)

PT

Generic Packet Tracer Plugin Wrapper.

Command

nscli pt $source_ip $destination_ip $destination_port

Options

-d, --device

CORE device number

-a, --account

CORE account number

--sport SPORT

source port (default is 1024)

-u, --udp

match UDP (default TCP)

-D, --detailed

detailed output

-P, --public

Connect via Public IP.

-U USER, --user USER

Specify the user.